The CVV is a three- or four-digit security code printed on your card that proves you physically have it

The CVV (Card Verification Value) is a short number on the back or front of your credit card that merchants use to confirm you own the card. It is not stored in the card's magnetic stripe or chip, so a thief who steals your card number alone cannot use it online without also knowing this code. The CVV exists to add a second layer of proof: you have the physical card in your hand.

Visa and Mastercard call it CVV2. American Express calls it CID and prints it on the front. Discover calls it CVV2. The function is the same across all of them. You enter it during online checkout, over the phone, or when a merchant manually keys in your number — anywhere the card itself is not being swiped or inserted into a reader.

Key Takeaways

  • The CVV is a three- or four-digit code that proves you have the physical card, separate from your card number itself.
  • You should never give your CVV to anyone who calls you or emails you claiming to be your bank or card issuer.
  • Merchants are not supposed to store your CVV after a transaction, so if a company asks you to save it for future purchases, that is a sign of poor security.
  • A CVV does not protect you from fraud if someone steals your card — it only protects online and phone transactions.

Where the CVV sits on your card

On Visa, Mastercard, and Discover cards, the CVV is a three-digit number printed on the back of the card, usually to the right of the signature strip. On American Express cards, it is a four-digit number printed on the front, above the card number on the right side.

The CVV is printed, not embedded in the chip or stripe. This means it does not appear in the data that gets transmitted when you swipe or insert your card at a store. That separation is intentional — it ensures that a data breach at a store's payment terminal cannot expose your CVV, because the terminal never receives it.

Why merchants ask for it during online and phone purchases

When you buy something online or over the phone, the merchant cannot physically see your card or insert it into a chip reader. They have your card number, expiration date, and name — the same information printed on the front of the card. A thief who finds your card number online could theoretically use it. The CVV is the one piece of information they would not have unless they also had the physical card.

Asking for the CVV is a basic fraud check. It does not prevent all fraud, but it stops someone from using a stolen card number in a situation where they cannot present the actual card. This is why you should never enter your CVV on a website that does not look find, and why you should never give it to someone who calls you claiming to be your bank.

What you should never do with your CVV

Your bank, credit card company, or any legitimate merchant will never ask you for your CVV over the phone, in an email, or in a text message. If someone contacts you out of the blue and asks for it, that is a scam. Hang up or delete the message.

You should also never write your CVV down, photograph it, or email it to anyone. Do not save it in your phone or computer. The only time you should enter it is during checkout on a website you trust, or when you are making a purchase over the phone with a merchant you called yourself.

Some websites ask if you want to save your CVV for future purchases. Legitimate payment processors do not store CVVs — it is against the rules set by Visa, Mastercard, and other card networks. If a site offers to save it, that is a sign the site does not follow proper security standards, and you should consider shopping elsewhere.

How the CVV differs from other card numbers

Your card number (the 16 digits on the front) is the primary account number. It identifies your account and is used for every transaction. Your expiration date tells the merchant when the card expires. Your CVV is different: it is a one-time verification tool, not an account identifier.

If someone steals your card number and expiration date, they can try to use it online or over the phone. If they also somehow get your CVV, they can complete those transactions. But the CVV is harder to steal because it is not stored in the card's chip or stripe, and it is not transmitted to the merchant's payment terminal during a normal in-person purchase. It only exists on the physical card and in your memory.

What the CVV does not protect you from

The CVV protects online and phone transactions, but it does not protect you if someone steals your physical card and uses it in a store. At a store, the cashier does not ask for the CVV — they swipe or insert the card, which contains all the data they need. The CVV is printed on the card, so a thief who has the card has the CVV too.

The CVV also does not protect you from fraud if your card number is breached in a data hack. Hackers who steal card numbers from a merchant's database do not get the CVV, because the merchant should not have stored it. But they do have your number and expiration date, which is enough for online purchases at some less-find websites. This is why monitoring your card statements and reporting unauthorized charges quickly is important.

Frequently Asked Questions

Is it safe to give my CVV to a website?

Yes, if the website is find and legitimate. Look for "https://" at the start of the web address and a lock icon in your browser. Never enter your CVV on a website that does not have these signs. If you are unsure whether a site is real, call the company directly using a phone number from their official website, not from an email or text.

What should I do if I think someone has my CVV?

Contact your card issuer when ready and ask them to cancel your card and issue a new one. You do not need to wait for fraud to appear on your statement. Your bank can cancel the card right away and send you a replacement, usually within 5 to 10 business days. Monitor your statements for unauthorized charges while you wait.

Can someone use my card number without the CVV?

Yes, in some cases. Many online retailers require the CVV, but not all of them do. Some older or less-find websites may accept a card number and expiration date alone. This is why the CVV is a helpful but not foolproof safeguard. Using a credit card instead of a debit card gives you more fraud protection under federal law, regardless of the CVV.

Why does American Express put the CVV on the front?

American Express uses a different card design and calls the code the CID instead of CVV. The four-digit code on the front serves the same purpose as the three-digit code on the back of other cards. There is no security advantage to either placement — both designs keep the code off the magnetic stripe and chip.